Collection visibility and granular access control in self-hosted Hoppscotch

Short answer

In the community edition of Hoppscotch, collections can be set to Private (owner only) or Public (anyone with the link). There is no built‑in role‑based access control (RBAC) or a switch to make a public link require authentication. The only way to restrict access to a specific group of authenticated users is to enforce login on the Hoppscotch instance itself (or via an external reverse‑proxy) and share the link only with users who are logged in.

Why this is the case

• The community edition’s API and UI expose only a single boolean flag for collection visibility.
• Shared links generated by the UI are always reachable by anyone who has the URL; the app does not perform an authentication check on link access.
• Advanced sharing features—team scopes, role‑based permissions, and granular ACLs—are available only in the Enterprise edition’s paid tier.

How to verify in your deployment

1. Check the UI: Open http://<hoppscotch-host>/collections and create a new collection. In the Visibility dropdown you should see only Private and Public options.
2. Generate a shared link: Click the share icon, choose Public, and copy the URL.
3. Test the link in incognito: Open the link in a private browser window. If you can view the collection without logging in, the link is truly public.
4. Inspect the source code (optional): In the Docker image’s src/components/CollectionShareModal.vue the isPublic flag is the only parameter accepted by the share‑API endpoint.
5. Review environment variables: The standard community image does not expose any RBAC‑related flags; look for HOPP_SCOTCH_RBAC_ENABLED or similar—none exist.

Implementing authenticated‑only access

Since the app itself cannot enforce this, you have two practical approaches:

1. Require login on the Hoppscotch instance:
   • Enable Hoppscotch’s built‑in authentication (JWT, OAuth, or basic auth).
   • Share the public link only with users who have valid credentials. The link will still be publicly reachable, but the UI will prompt for authentication before rendering the collection.
2. Use an external reverse‑proxy:
   • Configure a reverse‑proxy (NGINX, Traefik, etc.) to enforce HTTP basic auth or OAuth before the request reaches Hoppscotch.
   • All traffic—including shared‑link requests—must authenticate at the proxy level, effectively giving you group‑based access control outside the app.

Next steps and missing detail

If you already have an authentication system in place (e.g., corporate SSO) and want to know whether you can integrate it directly with Hoppscotch, let me know which auth provider you use. That will help determine the exact configuration steps for the reverse‑proxy or Hoppscotch JWT integration.

Summary

In short, the community edition does not support granular RBAC or authenticated‑only shared links. You must rely on Hoppscotch’s login or an external proxy to enforce group‑based access. The Enterprise edition offers the desired features if you need them built‑in.